How SQL injection exploits unsafe queries in PHP - Practice Exercises

Challenge - 5 Problems

❓ Predict Output

intermediate

What is the output of this PHP code with unsafe SQL query?

Consider this PHP code snippet that builds an SQL query unsafely using user input. What will be the output when the input is admin' -- ?

PHP

<?php
$user_input = "admin' -- ";
$query = "SELECT * FROM users WHERE username = '$user_input'";
echo $query;
?>

A SELECT * FROM users WHERE username = 'admin'' -- '

B SELECT * FROM users WHERE username = 'admin' --

C SELECT * FROM users WHERE username = 'admin -- '

D SELECT * FROM users WHERE username = 'admin\' -- '

💡 Hint

Look carefully at how the input is inserted directly into the query string.

The input admin' -- closes the string early and comments out the rest of the query. The output shows the query with the input inserted as-is, causing a potential SQL injection.

🧠 Conceptual

intermediate

Which part of this SQL query is vulnerable to injection?

Given this PHP code snippet, which part is the main cause of SQL injection vulnerability?

$query = "SELECT * FROM users WHERE username = '" . $_GET['user'] . "'";

A Concatenating user input directly into the query

B Using double quotes for the query string

C Using single quotes around the username

D Not using a semicolon at the end of the query

💡 Hint

Think about how user input is handled inside the query.

Directly adding user input into the query string without validation or escaping allows attackers to inject malicious SQL code.

🔧 Debug

advanced

What error occurs when this unsafe query is executed with input: ' OR 1=1 -- ?

Look at this PHP code snippet. What error or behavior will happen if the input is ' OR 1=1 -- ?

$input = "' OR 1=1 -- ";
$sql = "SELECT * FROM users WHERE username = '$input'";
$result = mysqli_query($conn, $sql);

A PHP fatal error due to undefined variable

B Syntax error in SQL query

C Empty result set returned

D The query returns all rows from the users table

💡 Hint

Consider what the injected SQL code does inside the WHERE clause.

The input closes the username string and adds OR 1=1, which is always true, so the query returns all rows, bypassing authentication.

📝 Syntax

advanced

Which option causes a syntax error in this unsafe SQL query?

Given this PHP code snippet, which option will cause a syntax error when executed?

$input = $_GET['input'];
$sql = "SELECT * FROM users WHERE username = '$input'";

A input = admin'; DROP TABLE users; --

B input = admin" OR 1=1 --

C input = admin

D input = admin' OR '1'='1

💡 Hint

Look at how quotes are used and closed in the query string.

Option A introduces a semicolon, attempting to execute multiple SQL statements (DROP TABLE users), which causes a syntax error since the query expects a single statement.

🚀 Application

expert

How can an attacker exploit this unsafe query to bypass login?

Given this PHP login code snippet, how can an attacker craft the username input to bypass password verification?

$username = $_POST['username'];
$password = $_POST['password'];
$sql = "SELECT * FROM users WHERE username = '$username' AND password = '$password'";
$result = mysqli_query($conn, $sql);
if (mysqli_num_rows($result) > 0) {
  echo 'Login successful';
} else {
  echo 'Login failed';
}

A username = admin' -- , password = anything

B username = admin, password = ' OR '1'='1

C username = admin' OR '1'='1, password = anything

D username = admin, password = admin

💡 Hint

Think about how to make the WHERE clause always true by injecting SQL in username.

Option C injects ' OR '1'='1 in username, making the WHERE clause always true and bypassing password check.

Practice

1. What is the main risk of using unsafe SQL queries in PHP without proper input handling?

easy

A. The website will load faster

B. Users will see more colorful pages

C. Attackers can insert harmful SQL commands to access or damage the database

D. The server will automatically block all users

Solution

1. Step 1: Understand unsafe SQL queries

   Unsafe queries allow user input directly in SQL commands without checks.

2. Step 2: Identify the risk of SQL injection

   This lets attackers add harmful commands to steal or change data.

3. Final Answer:

   Attackers can insert harmful SQL commands to access or damage the database -> Option C

4. Quick Check:

   Unsafe queries = SQL injection risk [OK]

Hint: Unsafe queries let attackers add harmful commands [OK]

Common Mistakes:

• Thinking unsafe queries improve speed
• Confusing SQL injection with visual changes
• Assuming server blocks all users automatically

2. Which PHP code snippet is unsafe and vulnerable to SQL injection?

easy

A. $query = "SELECT * FROM users WHERE name = '" . $_GET['name'] . "'";

B. $stmt = $pdo->prepare('SELECT * FROM users WHERE name = ?'); $stmt->execute([$_GET['name']]);

C. $stmt = $pdo->prepare('SELECT * FROM users WHERE name = :name'); $stmt->execute(['name' => $_GET['name']]);

D. $query = 'SELECT * FROM users WHERE name = :name'; $stmt = $pdo->prepare($query); $stmt->execute(['name' => 'Alice']);

Solution

1. Step 1: Identify direct user input in query string

   $query = "SELECT * FROM users WHERE name = '" . $_GET['name'] . "'"; directly inserts $_GET['name'] into the SQL string without protection.

2. Step 2: Compare with prepared statements

   Options A, B, and D use prepared statements which safely handle input.

3. Final Answer:

   $query = "SELECT * FROM users WHERE name = '" . $_GET['name'] . "'"; -> Option A

4. Quick Check:

   Direct input in query = unsafe [OK]

Hint: Directly adding user input to query is unsafe [OK]

Common Mistakes:

• Confusing prepared statements with unsafe queries
• Thinking all string concatenations are safe
• Ignoring the use of placeholders in queries

3. What will be the output of this PHP code if the URL parameter is ?id=1 OR 1=1?

$id = $_GET['id'];
$query = "SELECT * FROM users WHERE id = $id";
echo $query;

medium

A. SELECT * FROM users WHERE id = 1

B. SELECT * FROM users WHERE id = 1 OR 1=1

C. Syntax error in SQL query

D. SELECT * FROM users WHERE id = '1 OR 1=1'

Solution

1. Step 1: Substitute the URL parameter into the query

   The variable $id becomes the string "1 OR 1=1" directly inserted into the query.

2. Step 2: Form the final SQL query string

   The query becomes: SELECT * FROM users WHERE id = 1 OR 1=1, which is a valid SQL statement.

3. Final Answer:

   SELECT * FROM users WHERE id = 1 OR 1=1 -> Option B

4. Quick Check:

   Unsafe input inserted directly = query with injected condition [OK]

Hint: Direct input inserts raw text into query [OK]

Common Mistakes:

• Assuming input is automatically quoted
• Expecting syntax error without quotes
• Ignoring how SQL interprets OR conditions

4. Identify the error in this PHP code that makes it vulnerable to SQL injection:

$username = $_POST['username'];
$query = "SELECT * FROM users WHERE username = '$username'";
$result = mysqli_query($conn, $query);

medium

A. The query string is missing a semicolon

B. The variable $username is not defined

C. mysqli_query cannot run SELECT queries

D. Using prepared statements would prevent SQL injection

Solution

1. Step 1: Check how user input is used in the query

   The variable $username is inserted directly into the SQL string without sanitization.

2. Step 2: Suggest the fix to prevent injection

   Using prepared statements safely handles input and prevents injection attacks.

3. Final Answer:

   Using prepared statements would prevent SQL injection -> Option D

4. Quick Check:

   Direct input in query = vulnerability [OK]

Hint: Use prepared statements to fix injection bugs [OK]

Common Mistakes:

• Thinking variable is undefined
• Believing mysqli_query can't run SELECT
• Focusing on missing semicolon instead of security

5. You want to fix this vulnerable PHP code to prevent SQL injection:

$email = $_POST['email'];
$query = "SELECT * FROM users WHERE email = '$email'";
$result = mysqli_query($conn, $query);

Which is the best way to fix it?

hard

A. $stmt = $conn->prepare('SELECT * FROM users WHERE email = ?'); $stmt->bind_param('s', $email); $stmt->execute();

B. $email = addslashes($_POST['email']); $query = "SELECT * FROM users WHERE email = '$email'"; mysqli_query($conn, $query);

C. $query = "SELECT * FROM users WHERE email = '" . $_POST['email'] . "'"; mysqli_query($conn, $query);

D. $email = htmlspecialchars($_POST['email']); $query = "SELECT * FROM users WHERE email = '$email'"; mysqli_query($conn, $query);

Solution

1. Step 1: Review each option's security

   $stmt = $conn->prepare('SELECT * FROM users WHERE email = ?'); $stmt->bind_param('s', $email); $stmt->execute(); uses prepared statements with parameter binding, which safely handles input.

2. Step 2: Compare other options

   $email = addslashes($_POST['email']); $query = "SELECT * FROM users WHERE email = '$email'"; mysqli_query($conn, $query); uses addslashes which is not fully safe; C is unsafe direct insertion; D uses htmlspecialchars which is for HTML, not SQL.

3. Final Answer:

   $stmt = $conn->prepare('SELECT * FROM users WHERE email = ?'); $stmt->bind_param('s', $email); $stmt->execute(); -> Option A

4. Quick Check:

   Prepared statements = best SQL injection protection [OK]

Hint: Use prepared statements with bind_param for safety [OK]

Common Mistakes:

• Relying on addslashes for security
• Using htmlspecialchars for SQL input
• Continuing direct string concatenation